Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 3 subscribers
  • Views 9649 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SNTPService.exe (sophos network threat protection service) with high memory usage

GCCA

Hello Community,

I have a computer that sophos network threat protection service is always growing up in memory until it crash the main application that was running on it.

the process is called: SNTPSERVICE.EXE

I uninstalled Sophos, restarted and reinstalled it but still the same. It is now consuming 4gbits of RAM memory.

Sophos Endpoint Security and Control version 10.7

Windows 7 64Bits

 

In my Sophos Console, I can see an Error dated from 01/29/2018 that says :

The on-access driver was unable to create an impresonation token for file \Device\HarddiskVolume2\Users\****\AppData\Local\Temp\OLKEDFD.tmp. [0xe3d000f]

 

Any ideas?

 



This thread was automatically locked due to age.
  • +1

    Hello GCCA,

    off the top of my head this is something Support should look into. How fast it is growing? Anything unusual about or in the NTP log? Oh and BTW, n cases like this one the minor SAV version is equally important - not just 10.7 but 10.7.2 or 10.7.6, and ideally all available sophostications [sorry, couldn't resist] of the version number.
    The SAV error is "just" a consequence of the apparent memory depletion.

    Christian

  • 0 in reply to QC

    Hello QC,

    The SAV version is 10.7.6 VE3.70.2

    It takes approximatly 1 hour to grow up to 3.5Gbits then it stay at 3.5GB.

    Sophos NTP log 

    Full of :

    a 2018-01-30 09:11:45.352 [2140:2204] - Process: '\device\harddiskvolume2\windows\system32\spoolsv.exe' accessed: 10.228.117.41:65002
a 2018-01-30 09:11:45.356 [2140:2204] - Process: '\device\harddiskvolume2\windows\system32\spoolsv.exe' accessed: 10.228.117.41:65002
a 2018-01-30 09:11:45.359 [2140:2204] - Process: '\device\harddiskvolume2\windows\system32\spoolsv.exe' accessed: 10.228.117.41:65002
a 2018-01-30 09:11:45.361 [2140:2204] - Process: '\device\harddiskvolume2\windows\system32\spoolsv.exe' accessed: 10.228.117.41:65002
a 2018-01-30 09:11:45.364 [2140:2204] - Process: '\device\harddiskvolume2\windows\system32\spoolsv.exe' accessed: 10.228.117.41:65002
a 2018-01-30 09:11:45.366 [2140:2204] - Process: '\device\harddiskvolume2\windows\system32\spoolsv.exe' accessed: 10.228.117.41:65002
a 2018-01-30 09:11:45.369 [2140:2204] - Process: '\device\harddiskvolume2\windows\system32\spoolsv.exe' accessed: 10.228.117.41:65002

    Thanks for your help QC :-)
  • 0 in reply to GCCA

    It is a printer that was flooding our computer.

    Thanks for help

Unfiltered HTML